A little forensic script to extract a pupy payload's config.

dump_pupyconfig.py

#!/usr/bin/env python
# -*- coding: UTF8 -*-

import sys
import struct
import pylzma

if __name__=="__main__":
    data=b""
    found=False
    with open(sys.argv[1], 'rb') as fd:
        data=fd.read()
    for i in range(int(0), len(data)):
        try:
            size_compressed, size_uncompressed = struct.unpack(">II", data[i:i+8])
            if size_compressed > 65536:
                continue
            data=pylzma.decompress(data[i+8:i+8+size_compressed])
            if len(data)==size_uncompressed:
                print("decompressed config valid at offset %s"%i)
                print(data)
                found=True
        except Exception as e:
            continue
    if not found:
        print("config not found :'(. The template has probably been modified")